From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58628) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZMo5N-0005HP-QG for qemu-devel@nongnu.org; Tue, 04 Aug 2015 22:05:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZMo5K-0003hZ-6g for qemu-devel@nongnu.org; Tue, 04 Aug 2015 22:05:41 -0400 Date: Wed, 5 Aug 2015 12:05:35 +1000 From: David Gibson Message-ID: <20150805020535.GB8785@voom.redhat.com> References: <1438557800-6947-1-git-send-email-gwshan@linux.vnet.ibm.com> <1438557800-6947-3-git-send-email-gwshan@linux.vnet.ibm.com> <20150803025109.GE15727@voom.fritz.box> <20150803033253.GA18268@gwshan> <55C0444A.2070206@ozlabs.ru> <20150804071644.GA16383@gwshan> <55C06872.8060309@ozlabs.ru> <20150804105529.GA9980@gwshan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="0ntfKIWw70PvrIHh" Content-Disposition: inline In-Reply-To: <20150804105529.GA9980@gwshan> Subject: Re: [Qemu-devel] [PATCH RESEND v2 2/3] sPAPR: Support RTAS call ibm, {open, close}-errinjct List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gavin Shan Cc: Alexey Kardashevskiy , qemu-ppc@nongnu.org, qemu-devel@nongnu.org --0ntfKIWw70PvrIHh Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Aug 04, 2015 at 08:55:29PM +1000, Gavin Shan wrote: > On Tue, Aug 04, 2015 at 05:23:30PM +1000, Alexey Kardashevskiy wrote: > >On 08/04/2015 05:16 PM, Gavin Shan wrote: > >>On Tue, Aug 04, 2015 at 02:49:14PM +1000, Alexey Kardashevskiy wrote: > >>>On 08/03/2015 01:32 PM, Gavin Shan wrote: > >>>>On Mon, Aug 03, 2015 at 12:51:09PM +1000, David Gibson wrote: > >>>>>On Mon, Aug 03, 2015 at 09:23:19AM +1000, Gavin Shan wrote: > >>>>>>The patch supports RTAS calls "ibm,{open,close}-errinjct" to > >>>>>>manupliate the token, which is passed to RTAS call "ibm,errinjct" > >>>>>>to indicate the valid context for error injection. Each VM is > >>>>>>permitted to have only one token at once and we simply have one > >>>>>>random number for that. > >>>>>> > >>>>>>Signed-off-by: Gavin Shan > >>>>>>--- > >>>>>> hw/ppc/spapr_rtas.c | 71 +++++++++++++++++++++++++++++++++++++= +++++++++++++ > >>>>>> include/hw/ppc/spapr.h | 9 ++++++- > >>>>>> 2 files changed, 79 insertions(+), 1 deletion(-) > >>>>>> > >>>>>>diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c > >>>>>>index e99e25f..0a9c904 100644 > >>>>>>--- a/hw/ppc/spapr_rtas.c > >>>>>>+++ b/hw/ppc/spapr_rtas.c > >>>>>>@@ -604,6 +604,73 @@ out: > >>>>>> rtas_st(rets, 0, rc); > >>>>>> } > >>>>>> > >>>>>>+static void rtas_ibm_open_errinjct(PowerPCCPU *cpu, > >>>>>>+ sPAPRMachineState *spapr, > >>>>>>+ uint32_t token, uint32_t nargs, > >>>>>>+ target_ulong args, uint32_t nre= t, > >>>>>>+ target_ulong rets) > >>>>>>+{ > >>>>>>+ int32_t ret; > >>>>>>+ > >>>>>>+ /* Sanity check on number of arguments */ > >>>>>>+ if ((nargs !=3D 0) || (nret !=3D 2)) { > >>>>>>+ ret =3D RTAS_OUT_PARAM_ERROR; > >>>>>>+ goto out; > >>>>>>+ } > >>>>>>+ > >>>>>>+ /* Check if we already had token */ > >>>>>>+ if (spapr->errinjct_token) { > >>>>>>+ ret =3D RTAS_OUT_TOKEN_OPENED; > >>>>>>+ goto out; > >>>>>>+ } > >>>>>>+ > >>>>>>+ /* Grab random number as token */ > >>>>>>+ spapr->errinjct_token =3D random(); > >>>>> > >>>>>I don't quite understand the function of this token. Using random() > >>>>>seems a very, very odd way of doing things. Is it supposed to be a > >>>>>security thing? > >>>>> > >>>> > >>>>Yes, the token is allocated by "ibm,open-errinjct". The token will be > >>>>passed to subsequent "ibm,errinjct" and "ibm,close-errinjct". From th= is > >>>>perspecitve, the token owner is allowed to do error injection and it's > >>>>for security. Apart from having random number as the token, is there > >>>>better (fast) way to produce it? > >>>> > >>>>>>+ if (spapr->errinjct_token =3D=3D 0) { > >>>>>>+ ret =3D RTAS_OUT_BUSY; > >>>>> > >>>>>AFAICT, this gives a 1 in RAND_MAX chance of returning RTAS_OUT_BUSY > >>>>>for no particular reason. > >>>>> > >>>> > >>>>Yes, "0" represents invalid token (not opened). Maybe here we can ret= ry > >>>>for a bit more like below. 0 returned from 10 successive random() wou= ld > >>>>be rare. > >>>> > >>>> uint32_t retries; > >>>> > >>>> while (!spapr->errinjct_token && retries++ < 10) > >>>> spapr->errinjct_token =3D random(); > >>>> if (!spapr->errinjct_token) { > >>>> ret =3D RTAS_OUT_BUSY; > >>>> goto out; > >>>> } > >>> > >>> > >>>No. QEMU is using rand() (not random()) and since it returns up to RAN= D_MAX > >>>which is 0x7fffffff, you could do something simple like this: > >>> > >>>spapr->errinjct_token =3D (rand % 32767) + 1 > >>> > >> > >>Good idea. I'll have it in next revision. > >> > >>Thanks, > >>Gavin > >> > >>> > >>>But for debugging purposes it makes more sense just to initialize it t= o 1 and > >>>then increment it in every call of rtas_ibm_open_errinjct(). > > > > > >Why rand() and not this? You do not protect against a guest attack by > >limiting a number of the rtas calls so the token just needs to be unique= and > >that's it, and later in gdb is is going to be easier to trace these toke= ns if > >need for this ever arises. > > >=20 > When calling rtas_ibm_close_errinjct(), the token (spapr->errinjct_token) > will be zero'ed to indicate: the token has been closed. Alternatively, one > statistics can be added if it's not expensive. However, I don't understand > why we need trace the number of error injections that was ever raised. Co= uld > you please share the purpose about that? I understand that, but using a token from random() just doesn't make sense. 1) If this is just to prevent accidental multiple users of the device, then an incrementing counter is simpler, easier to understand and just as good. 2) If this is supposed to securely prevent other users from controlling device then a) there's no point, it requires privilege in the guest anyway, and b) you'd have to use a secure random number source, not a pseudo-rng like random(). Oh, also, you haven't added the token to the migration stream, which means a migration would silently close the token. --=20 David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson --0ntfKIWw70PvrIHh Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVwW9vAAoJEGw4ysog2bOSvFgQAIGMCabaR/+zg9V8/uxe1y8R XinXwdnIGCtQw3e01YfjIK1TrW11yv/seBmbFGejxH/050ykIlk6re5Ty6umxkkl vYzzmuD6rA1D2K2n9P+dD34i9XFNrNpGG0AhMjot8+nrxsp4Cd5tLpskwoITKslq pvGZF6gK8dtxPBvu1ndQ3FhnlBeFEAAJ2qBSH1HZur3StxjVVSqiMtckjcw03GN0 i6pUoYDmNV5Ibu6D8fgpl9Pn6XmPQkzka1jQZCQMSeZVEIPMlQvakhZG7BoiGnDl iRt7t+sO/8yU78KiPODuOzPTnIMCuJ1rUnXLxonmI14UFgsI1X83Xt/KGHuTdCqR XtzWPJsfgMMwr015wUcZ8UNtof6dWpfgbU7FfLjMZyxi2pSZQ+HJg3BcAtr87mYA G01SVfPNQO8JlPsK2rIBzwPTgHoFXdArKB5i7KIYIe+a7FLg3NaReVczbQg9JhQX d1YnXcHgK3FJ5kHhImZ2Mj1zo4hghrasauIpTkCDr1jHogWiVSg6w+ZEZbxkn5lH aVlRPpfVIDTyHC/QnyuwTTyobKft6afiQg3h/JVeCDrnda1ng9EicNOC2/5FWE4W 34sMcsg7JzCg3pnM35WAYNCr3kZX0FA8Lh0w2F2LFIfoBeRXzfB5LF+cDpOcheRb AxrXFqBXBT6v3Hy7qxQl =N+0d -----END PGP SIGNATURE----- --0ntfKIWw70PvrIHh--